The increased use of “cloud computing”, the speed with which the cloud has developed and the need for the rules on discovery in litigation and the courts to keep pace with those developments have created challenges for practitioners. For example, who has possession or custody over emails which are stored on servers owned by cloud service providers?
This question arose in Dirak Asia Pte Ltd and another v Chew Hua Kok and another (9 January 2013), a decision of the Singapore High Court. The case involved an application for discovery of emails in a dispute between ex-employers and ex-employees over alleged breaches of fiduciary duties and contractual clauses under the ex-employees’ employment contracts.
The Singapore Court had to consider whether an email user has possession and custody over emails stored on servers and in data centres which may be in remote locations and where the user has not stored a copy of the relevant emails on their computer, hard drive, smart phone, tablet or other device.
The ex-employers were seeking disclosure of the emails in the accounts in which the ex-employees’ emails were stored. It was not disputed that the emails in question were stored on the servers of a third party. It was argued that this was no bar to the granting of a discovery order, given that the ex-employees had the practical ability to access the emails in their accounts.
The Singapore Court had to consider whether emails in the possession and custody of a third party were in the defendants’ “power” and the extent to which a cloud user could be said to have “power” over electronically stored information in the possession of a cloud service provider.
It is said that more than 80% of companies now use the cloud in some way1 with more than 50% reporting that they planned to boost their investment in the cloud by at least 10% in the next twelve months. It is not surprising therefore, that the recovery of data from cloud service providers and the issues of obtaining that data on discovery, determining which country it is held in, searching it, privacy rules and even who owns it have become complicated questions to answer2.
The Singapore Court considered the approach adopted by both US and English authorities and the approach adopted by the courts in those jurisdictions to the analysis of the relationship between the producing party and the third party in possession of the documents to determine whether the producing party had the legal right or the “right, authority or practical ability” to obtain the documents from a non-party to the action (e.g. the cloud service provider). It concluded that reaching the answer involved a fact intensive exercise that required a contextual appreciation of the relationship between the producing party and the third party in possession and custody of the documents.
However, the Singapore Court recognised that care should be taken not to equate the practical ability to access documents with having “power” over them so as to automatically render the party subject to a discovery order. Practical ability to access documents could be one measure to determine the factual enquiry as to whether or not the producing party had power over the documents, but it did not mean that that party would have such power in every situation.
The Singapore Court considered the US decision of Flagg v City of Detroit3, in which the US Court had to decide whether text messages sent by an employee which were kept in a system maintained by a third party provider could be said to be within the City of Detroit’s control. The Court examined the relationship between the City and the third party provider, finding that the City did have “control” over the information. A similar fact intensive investigative approach was adopted in Ice Corp v Hamilton Sundstrand Corp4, where multiple factors were considered and balanced, including who had access to the documents, how they were used, who had generated, acquired or maintained them and what evidence there was of transfer of ownership or title to the documents.
When considering the position under English law, the Singapore Court looked at a number of decisions, including the House of Lords decision in Lonrho Ltd v Shell Petroleum5 and the Court of Appeal decisions inRe Tecnion Investments Ltd6 and North Shore Ventures Limited v Anstead Holdings Inc7. All of these pre-date the cloud.
The Singapore Court concluded that the earlier, rigid concept of “power” stated by Lord Diplock in Lonrho - “a presently enforceable legal right to obtain from whoever actually holds the document…without the need to obtain the consent of anyone else” - should give way to a more flexible approach, like that in North Shore Ventures and have regard to the Rules of Civil Procedure8 for documents. These provide that a party’s duty to disclose documents extends to documents in his control including whether he has a right to possession of the documents or a right to inspect or take copies of them. In North Shore Venture, the Court of Appeal had refused to adopt a narrow understanding of “control” and had rejected the submission that it was confined to the Lonrho “legal right to possession or legal right to obtain copies” type definition.
Based upon the evidence, the Singapore Court held that the ex-employees’ practical ability to access the documents in the course of their employment translated into actual possession and so they had “power” over the emails in their accounts even though they did not have soft copies on their storage devices, or printed hard copies.
It is not surprising the companies are discovering the advantages of the cloud given the cost savings and cheaper storage it offers. But issues as to ownership of the data stored there, where it is physically located, privacy laws, security and the duties of the cloud service providers to respond to subpoenas or third party data requests all give rise to new challenges within e-discovery. Consequently, where organisations no longer maintain physical control of their data, questions as to who has access to it and on what terms may not be easy to answer. The Singapore Court’s decision suggests that a factual investigation will be required in each case.